Discord: org owners can't register their own (BYO) radio bot or its OAuth secret — platform-admin only #273

New Issue

2026-10-05T03:25:58-04:00

logan commented

2026-10-05 03:25:58 -04:00

Found while building #225 S8 (PR #271): it is the last thing between an owner and the "one-bot org" setup they asked for in #225.

What happens: an org owner can now do everything for their own radio bot except register it. They can mark it preferred for their system (Q2), connect a server through its OAuth invite, pick a channel and stream. Two steps are still require_admin_token, though:

POST /tokens adds a bot token, including a BYO one with org_id set. See routers/tokens.py add_token.
PUT /tokens/{id}/oauth sets the bot app's client secret, which turns on Connect.

So "invite only the radio bot for your system, mark preferred, stream" needs a DRB platform admin once per BYO bot. With pool bots the org doesn't need either step.

Why it isn't a one-line fix:

An owner-facing route takes a bot token and a client secret from a browser.
Both are stored in plaintext Firestore fields today (#261).
The route needs org-scoping, so a token can only be registered as the caller's own org's BYO and never as pool.
It needs rate limits and an audit trail.
It needs a check that the token isn't already registered, since the same bot in two orgs would break lease exclusivity.
It needs an owner-side surface. Org owners have no Discord settings view today (#221).

Scope: owner-scoped POST /org/tokens and PUT /org/tokens/{id}/oauth, BYO-only, with dedup by bot_user_id. Decide with #261 whether secrets get app-level encryption first.

Refs #225, #221, #261.

Found while building #225 S8 (PR #271): it is the last thing between an owner and the "one-bot org" setup they asked for in #225. **What happens:** an org owner can now do everything for their own radio bot except register it. They can mark it preferred for their system (Q2), connect a server through its OAuth invite, pick a channel and stream. Two steps are still `require_admin_token`, though: - `POST /tokens` adds a bot token, including a BYO one with `org_id` set. See `routers/tokens.py` `add_token`. - `PUT /tokens/{id}/oauth` sets the bot app's client secret, which turns on Connect. So "invite only the radio bot for your system, mark preferred, stream" needs a DRB platform admin once per BYO bot. With pool bots the org doesn't need either step. **Why it isn't a one-line fix:** - An owner-facing route takes a bot token and a client secret from a browser. - Both are stored in plaintext Firestore fields today (#261). - The route needs org-scoping, so a token can only be registered as the caller's own org's BYO and never as pool. - It needs rate limits and an audit trail. - It needs a check that the token isn't already registered, since the same bot in two orgs would break lease exclusivity. - It needs an owner-side surface. Org owners have no Discord settings view today (#221). **Scope:** owner-scoped `POST /org/tokens` and `PUT /org/tokens/{id}/oauth`, BYO-only, with dedup by `bot_user_id`. Decide with #261 whether secrets get app-level encryption first. Refs #225, #221, #261.

logan referenced this issue

2026-10-05 03:26:06 -04:00

Discord: customers shouldn't need the main DRB bot in their server — radio bots (via C2) should cover linking, channel directory and permission checks #225

logan referenced this issue

2026-10-05 03:26:06 -04:00

Discord: main DRB bot optional end to end + owner-flow integration tests (#225 S8) #271

logan referenced this issue

2026-10-05 03:31:21 -04:00

Discord: customers shouldn't need the main DRB bot in their server — radio bots (via C2) should cover linking, channel directory and permission checks #225

Sign in to join this conversation.